Resilience Reimagined: A Practical Guide for Organisations

Introduction

Resilience has been pushed firmly toward the top of the agenda for boards and senior management teams of organisations of all types. But how can resilience be developed? Who does it well, and what can we learn from them? What are the practical steps necessary to strengthen resilience for long-term success? As a leader, what more could you do to develop resilience for your organisation? To address these questions, we conducted twenty five in-depth interviews and four focus groups with leaders (boards, senior executives, policymakers and resilience directors) in organisations seen as world-leading in terms of their resilience programmes. At their request, all quotes presented in this report are anonymised. The sectors involved include water, energy, environment, transport, manufacturing, food retail and logistics, defence and security, information and communications technology (ICT), infrastructure and hospitality. Over fifty practitioners and academics contributed insights, experiences, and examples that helped shape our thinking and this report. We supplemented our data with a review of recent publications and reports on organisational resilience and referred to relevant literature and thought leadership.

Cranfield University conducted the research on behalf of the National Preparedness Commission (NPC). The research was undertaken in partnership with Deloitte, who sponsored and contributed to it. Our research found that leaders have traditionally relied on a systematic process to assure themselves and their boards that they have taken reasonable steps to build resilience. They have invested in a system of standards, including enterprise risk management (ERM), business continuity management (BCM), crisis incident management (CIM) and disaster recovery (DR). The hope is that these systems could help predict, prevent, and protect the organisation from threats and help the organisation bounce back from disruptions and crises. Organisations often employ BCM specialists and teams to make their programmes as ‘bulletproof ’ as possible, hoping that incidents will mostly disappear when a rigorous programme is in place. If something does go wrong, the hope is that having a comprehensive plan based on best practice management standards will help convince regulators and the public that their actions were reasonable and responsible. The improvements made in enhancing resilience over the years has been laudable.

Most of the time, the existing system works. Every day, normal business processes cope with the myriad of minor disruptions and issues. More significant incidents are usually covered by the organisation’s business continuity plan (BCP). Resilience is assured by plans, procedures, and compliance and focuses on recovering the organisation’s assets in a crisis. However, complex and more severe events are forcing organisations to be agile and fluid in their approach to respond and adapt effectively to unfamiliar or challenging situations. Many leaders now realise that relying on a reactive strategy is not enough on its own to meet the potential scale and pace of change imposed by sudden shocks and future challenges. Organisational resilience incorporates BCM but requires more than a reliance on procedures to recover assets (what if they can’t be recovered within reasonable timeframes, or at all?). Organisational resilience isn’t purely defensive in orientation. It is also progressive 1 , building the capacity for agility, adaptation, learning, and regeneration to ensure that organisations are able to deal with more complex and severe events and be fit for the future. The challenge of adaptation is exacerbated by today’s uncertain, complex, highly demanding and rapidly changing context in which organisations operate. Recent crises have raised serious questions about how rapidly organisations can adapt to changing threats, disturbances, and perturbations (such as a pandemic, climate change, or cyber-attacks).

5 Resilience Reimagined: A practical guide for organisations